PYSEC-2026-4167 social-auth-core has an Improper Authentication issue

Impact The SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML...

Rocky Linux 8 [CIQ] Security Update: lasso / lasso-debuginfo / lasso-debugsource / lasso-devel (crlsa-2021_4325)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214325 advisory. lasso: XML signature wrapping vulnerability when parsing SAML responses CVE-2021-28091 Tenable has extracted the preceding description block directly from the CIQ...

CVE-2026-16443 Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...

CVE-2026-9090

Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary signing certificate. The buildSpCertificateStore function extracts the X.509 certificate directly from the incoming SAMLResponse instead of using the trusted...

USN-7872-1: Lasso vulnerabilities

It was discovered that Lasso incorrectly handled certain malformed SAML responses. A remote attacker could possibly use this issue to cause Lasso to crash, resulting in a denial of service. CVE-2025-46404 It was discovered that Lasso incorrectly handled certain malformed SAML assertion responses....

Critical: lasso

Issue Overview: A denial of service vulnerability exists in the lassoproviderverifysamlsignature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability. CVE-2025-4640...

AZL-69844 CVE-2025-46705 affecting package lasso for versions less than 2.9.0-1

A denial of service vulnerability exists in the gassertnotreached functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability...

EUVD-2018-12193

Malware in sbrugna...

EUVD-2020-0272

Malware in sbrugna...

EUVD-2022-7368

Malicious code in bioql PyPI...

EUVD-2025-6413

Malicious code in bioql PyPI...

BIT-GITLAB-2025-2256 Improper Validation of Specified Quantity in Input in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed unauthorized users to render the GitLab instance unresponsive to legitimate users by sending multiple concurrent large SAML responses...

CVE-2025-2256

An issue has been discovered in GitLab CE/EE affecting all versions from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed unauthorized users to render the GitLab instance unresponsive to legitimate users by sending multiple concurrent large SAML responses...

CVE-2025-2256

CVE-2025-2256 affects GitLab CE/EE: versions 7.12–18.1.6, 18.2–18.2.6, and 18.3–18.3.2. The issue allows an unauthenticated/unauthorized user to render the GitLab instance unresponsive for legitimate users by sending multiple concurrent large SAML responses. CVSS v3.1 base score 7.5 (High) with n...

CVE-2025-2256: Improper Validation of Specified Quantity in Input

An issue has been discovered in GitLab CE/EE affecting all versions from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed unauthorized users to render the GitLab instance unresponsive to legitimate users by sending multiple concurrent large SAML responses...

FreeBSD : Gitlab -- Vulnerabilities (602fc0fa-8ece-11f0-9d03-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 602fc0fa-8ece-11f0-9d03-2cf05da270f3 advisory. Gitlab reports: Denial of Service issue in SAML Responses impacts GitLab CE/EE Server-Side...

Exploit for Improper Verification of Cryptographic Signature in Pysaml2_Project Pysaml2

Technical Report on CVE-2021-21239: Redash SAML Authentication...

Debian dla-4288 : ruby-saml - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4288 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4288-1 [email protected] https://www.debian.org/lts/security/...

Linux Distros Unpatched Vulnerability : CVE-2025-25293

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ruby-saml provides security assertion markup language SAML single sign-on SSO for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote...

CVE-2025-25293

CVE-2025-25293 concerns the ruby-saml library used for SAML SSO in Ruby. The issue affects prior to versions 1.12.4 and 1.18.0, where remote attackers could trigger a Denial of Service by sending compressed SAML responses. The vulnerability stems from how ruby-saml decompresses SAML assertions wi...